6 files changed, 150 insertions, 5 deletions
diff --git a/Build/source/texk/web2c/ChangeLog b/Build/source/texk/web2c/ChangeLog
index c470a148f2b..73c38bb40bb 100644
--- a/Build/source/texk/web2c/ChangeLog
+++ b/Build/source/texk/web2c/ChangeLog
@@ -1,3 +1,8 @@
+2012-02-01  Peter Breitenlohner  <peb@mppmu.mpg.de>
+
+	* tex.ch, gftodvi.ch: Ensure dvi file size < 2GB.
+	* mf.ch: Ensure gf file size < 2GB.
+
 2012-01-24  Karl Berry  <karl@tug.org>
 
 	* doc/web2c.texi (Common options): remove doc for the long-since
diff --git a/Build/source/texk/web2c/alephdir/ChangeLog b/Build/source/texk/web2c/alephdir/ChangeLog
index 9e0879b59d2..b80ca2674bc 100644
--- a/Build/source/texk/web2c/alephdir/ChangeLog
+++ b/Build/source/texk/web2c/alephdir/ChangeLog
@@ -1,3 +1,7 @@
+2012-02-01  Peter Breitenlohner  <peb@mppmu.mpg.de>
+
+	* com16bit.ch: Ensure dvi file size < 2GB.
+
 2011-12-13  Peter Breitenlohner  <peb@mppmu.mpg.de>
 
 	* com16bit.ch, om16bit.ch: Consistency of `constants':
diff --git a/Build/source/texk/web2c/alephdir/com16bit.ch b/Build/source/texk/web2c/alephdir/com16bit.ch
index e8315adc203..e3e39c70718 100644
--- a/Build/source/texk/web2c/alephdir/com16bit.ch
+++ b/Build/source/texk/web2c/alephdir/com16bit.ch
@@ -1093,7 +1093,7 @@ else  if c="""" then begin
 @x [29.517] l.10002 - end_name: string recycling
 @ The third.
 @^system dependencies@>
- 
+
 @p procedure end_name;
 @y
 @ The third.
@@ -1617,6 +1617,37 @@ the bytes in one shot.  Much better even than writing four
 bytes at a time.
 @z
 
+@x [32.601] l.11911 - check dvi file size
+each time, we use the macro |dvi_out|.
+@y
+each time, we use the macro |dvi_out|.
+
+The length of |dvi_file| should not exceed |@"7FFFFFFF|; we set |cur_s:=-2|
+to prevent further \.{DVI} output causing infinite recursion.
+@z
+
+@x [32.601] l.11918 - dvi_swap: check dvi file size
+begin if dvi_limit=dvi_buf_size then
+@y
+begin if dvi_ptr>(@"7FFFFFFF-dvi_offset) then
+  begin cur_s:=-2;
+  fatal_error("dvi length exceeds ""7FFFFFFF");
+@.dvi length exceeds...@>
+  end;
+if dvi_limit=dvi_buf_size then
+@z
+
+@x [32.602] l.11932 -  empty the last bytes: check dvi file size
+if dvi_ptr>0 then write_dvi(0,dvi_ptr-1)
+@y
+if dvi_ptr>(@"7FFFFFFF-dvi_offset) then
+  begin cur_s:=-2;
+  fatal_error("dvi length exceeds ""7FFFFFFF");
+@.dvi length exceeds...@>
+  end;
+if dvi_ptr>0 then write_dvi(0,dvi_ptr-1)
+@z
+
 @x [32.617] l.12261 - Use output_comment if the user set it. Assume it's short enough.
   old_setting:=selector; selector:=new_string;
 @y
@@ -1648,6 +1679,11 @@ if ipc_on>0 then
     flush_dvi;
     dvi_gone:=dvi_gone+half_buf;
     end;
+  if dvi_ptr>(@"7FFFFFFF-dvi_offset) then
+    begin cur_s:=-2;
+    fatal_error("dvi length exceeds ""7FFFFFFF");
+@.dvi length exceeds...@>
+    end;
   if dvi_ptr>0 then
     begin write_dvi(0, dvi_ptr-1);
     flush_dvi;
@@ -1659,7 +1695,14 @@ if ipc_on>0 then
 endif ('IPC');
 @z
 
-@x [32.642] l.12742 - Use dvi_offset instead of dvi_buf_size with IPC stuff.
+@x [32.645] l.12766 - check dvi file size
+else  begin dvi_out(post); {beginning of the postamble}
+@y
+else if cur_s<>-2 then
+  begin dvi_out(post); {beginning of the postamble}
+@z
+
+@x [32.645] l.12775 - Use dvi_offset instead of dvi_buf_size with IPC stuff.
   k:=4+((dvi_buf_size-dvi_ptr) mod 4); {the number of 223's}
 @y
 ifdef ('IPC')
diff --git a/Build/source/texk/web2c/gftodvi.ch b/Build/source/texk/web2c/gftodvi.ch
index 01f689a02c8..3a523ec8163 100644
--- a/Build/source/texk/web2c/gftodvi.ch
+++ b/Build/source/texk/web2c/gftodvi.ch
@@ -475,6 +475,24 @@ begin
 end;
 @z
 
+@x [108] dvi_swap: check dvi file size
+begin if dvi_limit=dvi_buf_size then
+@y
+begin if dvi_ptr>(@"7FFFFFFF-dvi_offset) then
+  abort('dvi length exceeds "7FFFFFFF');
+@.dvi length exceeds...@>
+if dvi_limit=dvi_buf_size then
+@z
+
+@x [109] empty the last bytes: check dvi file size
+if dvi_ptr>0 then write_dvi(0,dvi_ptr-1)
+@y
+if dvi_ptr>(@"7FFFFFFF-dvi_offset) then
+  abort('dvi length exceeds "7FFFFFFF');
+@.dvi length exceeds...@>
+if dvi_ptr>0 then write_dvi(0,dvi_ptr-1)
+@z
+
 % [111] More .b?'s.
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 @x
diff --git a/Build/source/texk/web2c/mf.ch b/Build/source/texk/web2c/mf.ch
index e82053a1b41..f2b9a6d61a0 100644
--- a/Build/source/texk/web2c/mf.ch
+++ b/Build/source/texk/web2c/mf.ch
@@ -1942,6 +1942,38 @@ the bytes to be written in one shot.  Much better than writing four
 bytes at a time.
 @z
 
+@x [47.1155] check gf file size
+each time, we use the macro |gf_out|.
+@y
+each time, we use the macro |gf_out|.
+
+The length of |gf_file| should not exceed |@"7FFFFFFF|; we set
+|gf_prev_ptr:=0| to prevent further \.{GF} output causing infinite
+recursion.
+@z
+
+@x [47.1155] gf_swap: check gf file size
+begin if gf_limit=gf_buf_size then
+@y
+begin if gf_ptr>(@"7FFFFFFF-gf_offset) then
+  begin gf_prev_ptr:=0;
+  fatal_error("gf length exceeds ""7FFFFFFF");
+@.gf length exceeds...@>
+  end;
+if gf_limit=gf_buf_size then
+@z
+
+@x [47.1156] empty the last bytes: check gf file size
+if gf_ptr>0 then write_gf(0,gf_ptr-1)
+@y
+if gf_ptr>(@"7FFFFFFF-gf_offset) then
+  begin gf_prev_ptr:=0;
+  fatal_error("gf length exceeds ""7FFFFFFF");
+@.gf length exceeds...@>
+  end;
+if gf_ptr>0 then write_gf(0,gf_ptr-1)
+@z
+
 @x [47.1163] C needs k to be 0..256 instead of 0..255.
 procedure init_gf;
 var @!k:eight_bits; {runs through all possible character codes}
diff --git a/Build/source/texk/web2c/tex.ch b/Build/source/texk/web2c/tex.ch
index ef5e87212f7..b4a05724fac 100644
--- a/Build/source/texk/web2c/tex.ch
+++ b/Build/source/texk/web2c/tex.ch
@@ -2467,6 +2467,37 @@ the bytes in one shot.  Much better even than writing four
 bytes at a time.
 @z
 
+@x [32.601] l.11911 - check dvi file size
+each time, we use the macro |dvi_out|.
+@y
+each time, we use the macro |dvi_out|.
+
+The length of |dvi_file| should not exceed |@"7FFFFFFF|; we set |cur_s:=-2|
+to prevent further \.{DVI} output causing infinite recursion.
+@z
+
+@x [32.601] l.11918 - dvi_swap: check dvi file size
+begin if dvi_limit=dvi_buf_size then
+@y
+begin if dvi_ptr>(@"7FFFFFFF-dvi_offset) then
+  begin cur_s:=-2;
+  fatal_error("dvi length exceeds ""7FFFFFFF");
+@.dvi length exceeds...@>
+  end;
+if dvi_limit=dvi_buf_size then
+@z
+
+@x [32.602] l.11932 -  empty the last bytes: check dvi file size
+if dvi_ptr>0 then write_dvi(0,dvi_ptr-1)
+@y
+if dvi_ptr>(@"7FFFFFFF-dvi_offset) then
+  begin cur_s:=-2;
+  fatal_error("dvi length exceeds ""7FFFFFFF");
+@.dvi length exceeds...@>
+  end;
+if dvi_ptr>0 then write_dvi(0,dvi_ptr-1)
+@z
+
 @x [32.602] l.11944 - Allow for outputting more than 256 fonts.
 begin dvi_out(fnt_def1);
 dvi_out(f-font_base-1);@/
@@ -2573,6 +2604,11 @@ if ipc_on>0 then
     flush_dvi;
     dvi_gone:=dvi_gone+half_buf;
     end;
+  if dvi_ptr>(@"7FFFFFFF-dvi_offset) then
+    begin cur_s:=-2;
+    fatal_error("dvi length exceeds ""7FFFFFFF");
+@.dvi length exceeds...@>
+    end;
   if dvi_ptr>0 then
     begin write_dvi(0, dvi_ptr-1);
     flush_dvi;
@@ -2584,7 +2620,14 @@ if ipc_on>0 then
 endif ('IPC');
 @z
 
-@x [32.642] l.12742 - Use dvi_offset instead of dvi_buf_size with IPC stuff.
+@x [32.645] l.12766 - check dvi file size
+else  begin dvi_out(post); {beginning of the postamble}
+@y
+else if cur_s<>-2 then
+  begin dvi_out(post); {beginning of the postamble}
+@z
+
+@x [32.645] l.12775 - Use dvi_offset instead of dvi_buf_size with IPC stuff.
   k:=4+((dvi_buf_size-dvi_ptr) mod 4); {the number of 223's}
 @y
 ifdef ('IPC')
@@ -2595,13 +2638,13 @@ ifndef ('IPC')
 endifn ('IPC')
 @z
 
-@x [32.642] l.12773 - use print_file_name
+@x [32.645] l.12780 - use print_file_name
   print_nl("Output written on "); slow_print(output_file_name);
 @y
   print_nl("Output written on "); print_file_name(0, output_file_name, 0);
 @z
 
-@x [32.642] l.12750 - i18n fix
+@x [32.645] l.12782 - i18n fix
   print(" ("); print_int(total_pages); print(" page");
   if total_pages<>1 then print_char("s");
 @y